It works like this: When you want to pay for something you give them your login credentials to your bank account and a TAN and they send the money to the merchant for you.
The selling point of this service is that SEPA wire transfers usually take one day. But with their service the merchant gets an instant notification of money received and you can get your stuff one day earlier.
It's crazy but people use this and have no problem handling over the keys to their bank account.
I wonder whether there's more to that story. It seems like a potentially useful payment service, but it also seems like something the banks would surely be aware of. Customers giving up their credentials like that is probably a blatant violation of the bank's normal terms of business, and asking for those credentials or failing to keep them secure seems legally risky for the payment processor as well, particularly if anything ever goes wrong. Are you sure there's no separate agreement or commercial arrangement to cover this, probably between the payment processor and the banks?
But lacking wide spread of credit cards and the aversion of many merchants to PayPal here in Germany it's still pretty popular.
The banks don't like that payment processor and therefore just started a competitor where you only give your credentials to your bank. Hopefully it gains traction.
Part of the problem may be that people don't really understand where those keys are going. They put the information into their computer perhaps via keyboard. Beyond that they often don't know where it goes or where it gets stored. Perhaps they think it's stored locally in an app. For a while people didn't get the distinction between an app and a web site, but I think that's changing. People think Siri does voice recognition on their phone and freak out when you tell them all the recordings are sent to Apple and stored there.